hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is designing a secure…
A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?
⚠ Common exam trap
Many candidates confuse TPM's boot-time integrity measurement with runtime memory protection, or assume hypervisor isolation is sufficient against a compromised OS, not realizing SGX provides hardware-enforced enclave isolation that persists even when the OS is untrusted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intel Software Guard Extensions (SGX)
Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full disk encryption (FDE) with a strong passphrase
Why it's wrong here
Full disk encryption (FDE) with a strong passphrase secures data when it is stored on a disk (data at rest). While crucial for protecting against physical theft or unauthorized access to storage, FDE does not protect data once it is loaded into memory for processing. A secure enclave requires protection for data and code during execution, making FDE ineffective against attacks targeting runtime memory or CPU registers.
- ✗
Trusted Platform Module (TPM)
Why it's wrong here
A Trusted Platform Module (TPM) provides a hardware root of trust, enabling secure boot, cryptographic key storage, and platform integrity measurements. Although fundamental for system security, a TPM does not create an isolated execution environment for application code and data in runtime memory. It cannot prevent a malicious operating system or hypervisor from accessing an application's memory space during active processing.
- ✗
Hypervisor-based isolation
Why it's wrong here
Hypervisor-based isolation separates virtual machines (VMs) from each other and the host system, providing a layer of security for workloads. However, the hypervisor itself, along with the underlying host operating system, maintains privileged access to the memory and CPU state of all guest VMs. Consequently, if the hypervisor or host OS is compromised, the isolation provided to the guest VM's runtime memory can be bypassed, failing to establish a truly secure enclave against a privileged attacker.
- ✓
Intel Software Guard Extensions (SGX)
Why this is correct
Intel Software Guard Extensions (SGX) enables applications to create hardware-enforced secure enclaves, which are isolated regions of memory and CPU execution. These enclaves protect code and data from unauthorized access or modification by any other software on the system, including the operating system, hypervisor, and even BIOS/firmware. This robust isolation ensures the confidentiality and integrity of sensitive processing, even on a potentially compromised host.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Secure enclave
A secure enclave is a dedicated, isolated hardware component within a processor that protects sensitive data and code from unauthorized access, even if the main operating system is compromised.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.